PT-2017-14898

CVE-2017-17602

·

Publicado

2017-12-13

·

Atualizado

2017-12-26

Descrição por

CVSS 3.1
9.8
Crítica
MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Advance B2B Script version 2.1.3
Description The issue is related to SQL Injection, which can be exploited via the show id parameter in the "tradeshow-list-detail.php" endpoint or the pid parameter in the "view-product.php" endpoint.
Recommendations For Advance B2B Script version 2.1.3, consider restricting access to the tradeshow-list-detail.php and view-product.php endpoints until a patch is available, and avoid using the show id and pid parameters in these endpoints to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Identificadores relacionados
CVE-2017-17602
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com